Rust: More metrics for tracking taint. #18501
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
geoffw0
added
no-change-note-required
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
Files not reviewed (7)
- rust/ql/src/queries/summary/CryptographicOperations.ql: Language not supported
- rust/ql/src/queries/summary/QuerySinkCounts.ql: Language not supported
- rust/ql/src/queries/summary/QuerySinks.ql: Language not supported
- rust/ql/src/queries/summary/Stats.qll: Language not supported
- rust/ql/src/queries/summary/SummaryStats.ql: Language not supported
- rust/ql/src/queries/summary/TaintReach.qll: Language not supported
- rust/ql/test/query-tests/diagnostics/SummaryStats.expected: Language not supported
Tip: Copilot code review supports C#, Go, Java, JavaScript, Markdown, Python, Ruby and TypeScript, with more languages coming soon. Learn more
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
hvitved
reviewed
Jan 16, 2025
| private module TaintReachConfig implements DataFlow::ConfigSig { | ||
| predicate isSource(DataFlow::Node node) { node instanceof ActiveThreatModelSource } | ||
|
|
||
| predicate isSink(DataFlow::Node node) { any() } |
There was a problem hiding this comment.
This certainly looks like something that will not perform very well...
There was a problem hiding this comment.
Yes, though:
- we don't compute a path graph for this config.
- we never had any real issues with the same code in Swift.
- even on our largest database (
windows-rs) with a slightly warmed up cache, quick eval-inggetTaintReach()takes 2 seconds. With vast amounts of fake sources etc added to increase reach beyond what I think is ever plausible, 24s.
I'm guessing execution time is roughly linear in the number of nodes reached??? I'd be interested to hear your thoughts, concerns and suggestions - even if this means changing what we measure.
There was a problem hiding this comment.
OK, let's leave it as-is for now then.
paldepind
reviewed
Jan 16, 2025
paldepind
reviewed
Jan 16, 2025
paldepind
reviewed
Jan 16, 2025
Co-authored-by: Simon Friis Vindum <[email protected]>
paldepind
approved these changes
Jan 16, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add more metrics for tracking taint flow in Rust. Prior to this PR we have:
rust/summary/taint-sourcesandrust/summary/summary-statistics.rust/summary/sensitive-dataandrust/summary/summary-statistics.Which doesn't give us a very complete picture. This PR adds:
rust/summary/query-sinks,rust/summary/query-sink-countsandrust/summary/summary-statistics.rust/summary/cryptographic-operationsandrust/summary/summary-statistics.rust/summary/summary-statistics.rust/summary/summary-statistics.Most of these are soon to be added to our DCA runs (for catching regressions) and our metrics tracking page (to inform future work).
In the past people have raised performance concerns about taint reach, but I've never seen a problem in practice. DCA will confirm.